Cross-Site Scripting in extension "Frontend Treeview" (mh_treeview)

The extension fails to properly encode user input for output in HTML context...